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Amendments to the Claims: 

This listing of claims will replace all prior version, and listings, of claims in the 
application. 

Listing of Claims: 

1 (Cancelled). 

2 (Cancelled). 

3 (Cancelled). 

4 (Cancelled). 

5 (Cancelled). 

6 (Cancelled). 

7 (Cancelled). 

8 (Cancelled). 

9 (Cancelled). 

10 (Cancelled). 

1 1 (Cancelled). 

12 (Cancelled). 

13 (Cancelled). 

14 (Cancelled). 

15 (Canceled) 

16 (Currently Amended) A method for obfuscation of computer program execution 
flow to increase computer program security, the method comprising-: 

(a) break i ng tho computer codo into a p l ura li ty of codo sogmonts, and 
i dont i fv i nq partitioning the computer program into one or more non- 



critical code segments and one or more critical code segments to 
be obfuscated; 

(b) removing at least one of the critical code segments and embedding 
oach of ono or moro the critical code segments within rospoct i vo 
fifst one or more exception handlers , whoro i n whon tho computer 
program i s oxocutod, tho cr i tica l codo sogmonts aro oxocutod 
w i th i n tho rospoct i vo f i rst oxcopt i on hand l ers i n a korno l-l ovo l 
unprotoctod modo, whoro i n an oxocut i on path of tho cr i t i ca l codo 
sogmonts i s h i dden from a debugger program oxocut i ng i n a usor - 
l ovo l protoctod modo ; 

(c) providing the computer program with an exception set-up handler 
to set up operation of the f4fst exception handlers during the 
execution of the computer program ; 

(d) providing the computer program with e mb e dd i ng an in-line code 
segment inserted within a f i rst one of the r e ma i n i ng p l ura li ty of non- 
critical code segments for setting up and invoking the exception 
set-up handler? : and 

#He) executing the computer program on a computer having an 
operating system that provides kernel-level and user-level 
execution modes, and debug resources to support generation and 
processing of exceptions at specified addresses, wherein wh e n th e 
comput e r program — i s e x e cut e d, execution flow of computer 
program is maintained with the roma i n i ng p l ura li ty of non-critical 
code segments aro oxocutod executing in the user-level protected 
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mode, whoro i n an oxocut i on path of tho rema i n i ng p l ura li ty of codo 
segments i s v i s i b l e to the debugger program execut i ng i n the user - 
l eve l protected mode but when an address immediately prior to 
each one of the critical code segments in the execution flow is 
encountered, an exception occurs and the kernel-level execution 
mode is entered whereby control is transferred to the one or more 
exception handlers for execution of the critical code segments, and 
when the exception handlers complete execution, control is 
returned to non-critical code segments . 

1 7 (Currently Amended) The method of claim 1 6 wherein the providing (c) further 
includes: using the set-up handler to initiate a set-up of debug registers, such that the 
critical code segments in the exception handlers are executed at appropriate times 
during tho program execution of the computer program . 

1 8 (Previously Presented) The method of claim 1 6 wherein the embedding (d) 
further includes: executing the in-line code segment prior to a point in the program flow 
where any of the critical code segments was removed for placement into the exception 
handlers. 

1 9 (Currently Amended) The method of claim 1 8 further including: using the in-line 
code segment to install the exception set-up handler on an exception handler linked list 
for a current thread, such that when-an- one of the exceptions occurs, the operating 
system hands control to the exception set-up handler for execution. 
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20 (Previously Presented) The method of claim 19 further including: removing the 
exception set-up handler from the linked list after execution. 

21 (Previously Presented) The method of claim 17 wherein the embedding (b) 
further includes: inserting each of the exception handlers into the linked list. 

22 (Currently Amended) The method of claim 21 further including: when-an- one of 
the exceptions is raised to the operating system, handing control down the linked list 
until one of the exception handlers determines that the exception is one that the 
exception handler is designed to handle. 

23 (Previously Presented) The method of claim 22 further including: if the exception 
is one for which the current exception handler was designed to handle, executing the 
critical code segment included in the current exception handler. 

24 (Previously Presented) The method of claim 23 further including: if the exception 
is one for which the exception set-up handler was designed to handle, setting a return 
address for the exception set-up handler when the exception processing completes. 

25 (Previously Presented) The method of claim 24 further including: modifying 
debug registers during execution of the exception handlers such that any number of 
exception handlers may be daisy chained. 

-5- 
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26 (Currently Amended) The method of claim 1 6 wherein the embedding (b) further 
includes providing entry code for the fifst exception handlers to determine a nature of 
the exception. 

27 (Currently Amended) The method of claim 26 further including handling the 
exception if the nature of the exception is applicable to the-ajirst exception handler, 
otherwise handing exception processing to the next available exception handler. 

28 (Previously Presented) The method of claim 16 further including obfuscating the 
critical code segments to prevent reverse engineering. 

29 (Previously Presented) The method of claim 16 further including obfuscating the 
critical code segments to hide anti-piracy algorithms. 

30 (Currently Amended) The method of claim 16 further including providing code for 
the fret exception handlers to modify a return address to be used after completion of 
the exception processing. 

31 (Previously Presented) The method of claim 30 further including rearranging 
non-embedded code segments out of normal execution order, and setting exception 
addresses and return addresses to ensure proper program sequencing to further 
obfuscate the program execution flow. 

32 (Currently Amended) The method of claim 1 6 further including code within the 
fifst exception handlers to modify th«-exception conditions to support future exceptions. 

33 (Currently Amended) The method of claim 32, further including embedding a 
plurality of critical code segments within at least one of the fire* exception handlers. 

-6- 
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34 (Currently Amended) The method of claim 33, further including selecting which of 
a plurality of critical code segments within the at least one firet exception handler should 
be executed based on the-exception information. 

35 (Currently Amended) The method of claim 32, further including embedding one 
or more firet exception handlers into other firet exception handlers to further obfuscate 
the program execution flow. 

36 (Currently Amended) A method for obfuscation of computer program execution 
flow to increase computer program security, the method comprising : 

(a) partitioning the program into a p l urality of one or more non-critical code 
segments and at l oast ono one or more critical code segments; 

(b) obfuscating at least one of the critical code segments by removing the 
critical code segments and embedding each of one of the critical code 
segments within a rospoct i vo one or more exception handlers , whoro i n 
whon tho computer program is oxocutod, tho cr i t i ca l codo sogmonts aro 
oxocutod w i th i n tho rospoct i vo first oxcopt i on hand l ers i n a korno l-l ovo l 
unprotoctod modo, whoro i n an oxocut i on path of tho cr i t i ca l codo 
sogmonts i s h i dden from a debugger program oxocut i ng i n a usor -l ovo l 
prot e ct e d mod e; 

(c) providing the computer program with a driver to set up operation of the 
firet exception handlers during execution of the computer program ; and 

(d) providing the computer program with ombodd i ng an in-line code segment 
inserted within a firet non-critical code segment for invoking the driver 
when the program is executed -; and 
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(e) executing the computer program on a computer having an operating 
system that provides kernel-level and user-level execution modes, and 
debug resources to support generation and processing of exceptions at 
specified addresses, wherein whon tho computer program i s oxocutod, 
execution flow of computer program is maintained with the rema i n i ng 
p l ura li ty of non-critical code segments aro oxocutod executing in the user- 
level protected mode, whoro i n an oxocut i on path of tho rema i n i ng p l ura li ty 
of codo sogmonts i s v i s i b l e to tho debugger program oxocut i ng i n tho 
usor -l ovo l protected mode but when an address immediately prior to each 
one of the critical code segments in the execution flow is encountered, an 
exception occurs and the kernel-level execution mode is entered whereby 
control is transferred to the one or more exception handlers for execution 
of the critical code segments, and when the exception handlers complete 
execution, control is returned to the non-critical code segments . 

37 (Currently Amended) The method of claim 36 wherein the providing (c) further 
includes: using the driver to initiate a set-up of debug registers, such that the critical 
code segments in the exception handlers are executed at appropriate times during the 
program execution of the computer program . 

38 (Previously Presented) The method of claim 37 further including: executing the 
driver prior to a point in the program flow where any of the critical code segments was 
removed for placement into the exception handlers. 
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39 (Currently Amended) The method of claim 37 wherein the providing (b) further 
includes: inserting each of the exception handlers into the-ajinked list. 

40 (Currently Amended) The method of claim 39 further includes: when one of the 
exceptions is raised to the operating system, handing control down the linked list until 
one of the exception handlers determines that the exception is one that the exception 
handler is designed to handle. 

41 (Previously Presented) The method of claim 40 further includes: if the exception 
is one for which the current exception handler was designed to handle, executing the 
critical code segment included in the current exception handler. 

42 (Previously Presented) The method of claim 41 further including: if the exception 
is one for which the exception set-up handler was designed to handle, setting a return 
address for the exception set-up handler when the exception processing completes. 

43 (Previously Presented) The method of claim 42 further including: modifying 
debug registers during execution of the exception handlers such that any number of 
exception handlers may be daisy chained. 

44 (Currently Amended) The method of claim 36 wherein the providing (b) further 
includes providing entry code for the ftfst exception handlers to determine a nature of 
the exception. 

-9- 
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45 (Currently Amended) The method of claim 44, further comprising handling the 
exception if the nature of the exception is applicable to the-ajirst exception handler, 
otherwise handing exception processing to the next available exception handler. 

46 (Currently Amended) The method of claim 36, further comprising selecting from 
the p l ura li ty of one or more code segments the segments to obfuscate within the fire* 
exception handlers based on ths-a_value of obfuscating the algorithms within the 
segment. 

47 (Currently Amended) The method of claim 42, further comprising providing code 
for the fifst exception handlers to modify the return address to be used after completion 
of the exception processing 

48 (Currently Amended) The method of claim 47, further comprising rearranging the 
rema i n i ng non- omboddod critical code segments out of normal execution order, and 
setting exception addresses and return addresses to ensure proper program 
sequencing to further obfuscate the program execution flow. 

49 (Currently Amended) The method of claim 42, further comprising including code 
within the first exception handlers to modify the-exception conditions to support future 
exceptions. 



50 (Currently Amended) The method of claim 49, further comprising including a 
plurality of critical code segments within at least one of the firet exception handlers. 



51 (Currently Amended) The method of claim 50, further comprising selecting which 
of a plurality of critical code segments within the at least oneft fsi exception handler 
should be executed based on the-exception information 

52 (Previously Presented) The method of claim 36, further comprising including 
additional, unrelated driver code within the driver to further obfuscate the operation of 
the program execution flow. 

53 (Currently Amended) The method of claim 42, further comprising sott i ng 
wembedding one or more exceptions to occur within one or more firet other exception 
handlers, to bo hand l ed by othor f i rst oxcoption hand l ers, to further obfuscate the 
program execution flow. 

54 (Currently Amended) The method of claim 53, further comprising repeating the 
embedded exceptions within exception handlers such that the-required exception 
processing occurs at a plurality of exception processing levels, to further obfuscate the 
program execution flow. 



55 


(Cancelled). 


56 


(Cancelled). 


57 


(Cancelled). 


58 


(Cancelled). 


59 


(Cancelled). 


60 


(Cancelled). 


61 


(Cancelled). 


62 


(Cancelled). 



-11- 



Attorney Docket: 231 9P 

63 (Cancelled). 

64 (Cancelled). 

65 (Cancelled). 

66 (Cancelled). 

67 (Cancelled). 

68 (Cancelled). 

69 (Currently Amended) A system for obfuscation of program execution flow, 
comprising: 

a computer system including a processor, memory, an operating system that 
provides kernel-level and user-level execution modes, and debug resources to support 
the generation and processing of exceptions at specified addresses; and 
an obfuscated program comprising^ 

a p l ura li ty of one or more non-critical code segments, s uch that 
whon tho computer system oxocutos tho program, tho non - cr i t i ca l codo 
sogmonts aro oxocutod i n tho usor - lovo l oxocut i on modo, whoro i n an 
oxocut i on path of tho non - critical codo segments i s v i s i b l e to a 
d e bugg e r program e x e cut i ng i n th e us e r -le v el e x e cut i on mod e, 

a plurality of codes segments determined to be critical code 
segments that have been removed and encapsulated within rospoct i vo 
one or more exception handlers, and 

a set-up handler for setting up the debug resources such that 
when the computer system executes the program, th e e xc e pt i on 
hand l ers conta i n i ng tho cr i tica l codo sogmonts aro oxocutod i n tho 
korno l l ovo l modo, whoro i n an oxocut i on path of tho cr i t i ca l codo 

-12- 
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sogmonts i s h i dden from tho dobuggor program oxocut i ng i n tho usor - 
l ovo l oxocut i on modo execution flow of program is maintained with the 
non-critical code segments executing in the user-level protected mode, 
but when an address immediately prior to each one of the critical code 
segments in the execution flow is encountered, an exception occurs 
and the kernel-level execution mode is entered whereby control is 
transferred to the one or more exception handlers for execution of the 
critical code segments, and when the exception handlers complete 
execution, control is returned to the non-critical code segments . 

70 (New) A method for obfuscation of computer program execution flow to increase 
computer program security, the method comprising: 

(a) partitioning the computer program into one or more non-critical code 
segments, and one or more critical code segments to be obfuscated; 

(b) removing from the computer program, at least one of the critical code 
segments and embedding the removed critical code segments within one or more 
exception handlers, wherein the exception handlers run under kernel-level execution 
mode of a computer's operating system; 

(c) adding to the computer program, the exception handlers and code for setting- 
up the exception handlers during the execution of the program; 

(d) adding to the computer program, code for invoking at least one of the 
exception handlers at each location in the computer program where the critical code 
segments were to be invoked in the computer program prior to removal; and 

-13- 
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(e) executing the computer program on the computer having an operating 
system that provides kernel-level and user-level execution modes, wherein execution 
flow of computer program is maintained where the non-critical code segments execute 
in the user-level protected mode, and where when each location in the computer 
program previously occupied by the critical code segments is encountered, an 
exception occurs and the kernel-level execution mode is entered whereby control is 
transferred to the one or more exception handlers for execution of the critical code 
segments, and when the exception handlers complete execution, control is returned to 
the non-critical code segments. 
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